CVE-2024-42363: GHSL-2023-136_Samson
Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parsefile method where it is unsafely deserialized using the YAML.loadstream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42363?
The severity of CVE-2024-42363 is classified as high due to the potential for remote code execution through unsafely deserialized user input.
How do I fix CVE-2024-42363?
To fix CVE-2024-42363, update your Kubernetes installation to version 3385 or later.
What software is affected by CVE-2024-42363?
CVE-2024-42363 affects Kubernetes versions prior to 3385.
What is the impact of CVE-2024-42363?
The impact of CVE-2024-42363 includes potential unauthorized access and manipulation of application data.
How does CVE-2024-42363 occur?
CVE-2024-42363 occurs when a user-controlled role parameter is unsafely deserialized in the Kubernetes::RoleVerificationsController.